Skip to main content
Glama
alpernae

Intigriti MCP Server

by alpernae

Intigriti MCP Server

A Model Context Protocol (MCP) server for interacting with the Intigriti bug bounty platform's Researcher API. This enables AI assistants like Claude to help security researchers manage their bug bounty programs, submissions, and research workflow.

Version Node License

🚀 Features

This MCP server provides comprehensive tools for interacting with Intigriti:

📋 Program Management

  • List Programs - View all available bug bounty programs

  • Get Program Details - Access detailed program information

  • View Scope - See in-scope and out-of-scope assets

🐛 Submission Management

  • List Submissions - View your bug submissions with advanced filtering

  • Get Submission Details - Access full submission information

  • Create Submissions - Submit new bug reports

  • Add Comments - Update submissions with additional information

📊 Researcher Analytics

  • Get Stats - View your performance metrics and earnings

Related MCP server: MCP Intigriti Server

📦 Installation

Prerequisites

  • Node.js 18 or higher

  • npm or yarn

  • Intigriti account with researcher access

  • Intigriti API token

Step 1: Install Dependencies

npm install

Step 2: Get Your API Token

  1. Log in to Intigriti

  2. Navigate to your profile settings

  3. Go to the API section

  4. Generate a new API token with researcher permissions

  5. Copy the token securely

Note: You may need to contact Intigriti support to enable API access for your account.

Step 3: Configure Environment

Create a .env file in the project root:

INTIGRITI_API_TOKEN=your_api_token_here

Or export as an environment variable:

export INTIGRITI_API_TOKEN="your_api_token_here"

🔧 Configuration

For Claude Desktop

Add this configuration to your Claude Desktop config file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "intigriti": {
      "command": "node",
      "args": [
        "/absolute/path/to/intigriti-mcp-server/index.js"
      ],
      "env": {
        "INTIGRITI_API_TOKEN": "your_api_token_here"
      }
    }
  }
}

Important: Replace /absolute/path/to/intigriti-mcp-server/index.js with the actual path to your installation.

For Other MCP Clients

The server runs on stdio transport and can be integrated with any MCP-compatible client. Ensure you:

  1. Set the INTIGRITI_API_TOKEN environment variable

  2. Run the server with Node.js 18+

  3. Use stdio for communication

📖 Usage Examples

Once configured with Claude Desktop, you can use natural language to interact with Intigriti:

Viewing Programs

"Show me all available bug bounty programs"
"What programs can I participate in on Intigriti?"
"Get details about the [Company Name] program"
"What's the scope for the XYZ program?"

Managing Submissions

"List all my open bug submissions"
"Show me my accepted bugs from this month"
"Get details about submission abc-123-def"
"What's the status of my recent submissions?"

Submitting Bugs

"I found an XSS vulnerability in the XYZ program. Help me submit it."
"Create a new submission for [program] about [vulnerability type]"
"Add a comment to submission [id] with additional reproduction steps"

Viewing Statistics

"Show me my researcher statistics"
"What's my acceptance rate on Intigriti?"
"How many submissions have I made this year?"

🛠️ Available Tools

1. intigriti_list_programs

Lists all bug bounty programs available to you as a researcher.

Parameters: None

Returns: Array of programs with name, company, status, and reward information

Example:

List all available programs

2. intigriti_get_program

Gets detailed information about a specific program.

Parameters:

  • program_id (string, required) - Program identifier

Returns: Full program details including policy, rewards, response targets

Example:

Get details about program abc123

3. intigriti_get_program_scope

Retrieves the structured scope for a program.

Parameters:

  • program_id (string, required) - Program identifier

Returns: In-scope and out-of-scope assets

Example:

What's the scope for program xyz789?

4. intigriti_list_submissions

Lists your bug submissions with optional filtering.

Parameters:

  • program_id (string, optional) - Filter by program

  • status (string, optional) - Filter by status: open, closed, accepted, duplicate, na, informative

  • limit (number, optional) - Max results (default: 50)

Returns: Array of submissions

Example:

Show me all my accepted submissions
List open submissions for program abc123

5. intigriti_get_submission

Gets detailed information about a specific submission.

Parameters:

  • submission_id (string, required) - Submission UUID

Returns: Full submission details with communication history

Example:

Get details about submission 12345-abcd-6789

6. intigriti_create_submission

Submits a new bug report to a program.

Parameters:

  • program_id (string, required) - Target program

  • title (string, required) - Brief vulnerability title

  • description (string, required) - Detailed description

  • severity (string, required) - critical, high, medium, low, none

  • proof_of_concept (string, required) - Reproduction steps

  • endpoint (string, required) - Affected URL/endpoint

  • vulnerability_type (string, optional) - Type of vulnerability

Returns: Created submission details

Example:

Create a new XSS submission for program xyz with title "Reflected XSS in search parameter"

7. intigriti_add_submission_comment

Adds a comment to an existing submission.

Parameters:

  • submission_id (string, required) - Submission UUID

  • comment (string, required) - Comment text

Returns: Updated submission

Example:

Add comment "Additional proof of concept attached" to submission 12345

8. intigriti_get_researcher_stats

Retrieves your researcher statistics.

Parameters: None

Returns: Stats including total submissions, acceptance rate, reputation, earnings

Example:

Show me my researcher statistics

🔒 Security Best Practices

  • Never commit your API token to version control

  • Store tokens in environment variables or secure secret management

  • Rotate tokens periodically

  • Use tokens with minimum required permissions

  • Follow Intigriti's responsible disclosure policies

  • Review the .gitignore file to ensure secrets are excluded

⚠️ Error Handling

The server provides detailed error messages:

  • Authentication errors - Check your API token validity

  • Permission errors - Verify researcher access level

  • Not found errors - Confirm program/submission IDs are correct

  • Rate limit errors - Wait before making additional requests

  • Network errors - Check your internet connection

🚦 Rate Limits

Intigriti API has rate limits. The server will return appropriate error messages if limits are exceeded. For current rate limit information, check the Intigriti API documentation.

🐛 Troubleshooting

Server Won't Start

  • Verify Node.js version: node --version (must be ≥18)

  • Install dependencies: npm install

  • Check file permissions: chmod +x index.js

  • Verify path in Claude Desktop config

Authentication Fails

  • Confirm API token is valid and not expired

  • Check token has researcher permissions

  • Verify environment variable is set correctly

  • Ensure no extra spaces in token value

API Endpoint Errors

  • Intigriti API may have changed - check their documentation

  • Some endpoints may require specific permissions

  • Contact Intigriti support for API access issues

Connection Issues

  • Check your internet connection

  • Verify firewall isn't blocking the connection

  • Ensure you can access api.intigriti.com

📚 Resources

🤝 Contributing

Contributions are welcome! Please ensure:

  • Code follows existing style and conventions

  • New tools include proper descriptions and input schemas

  • README is updated with new functionality

  • All sensitive data is handled securely

  • Tests pass (when implemented)

📝 License

MIT License - see LICENSE file for details.

⚠️ Disclaimer

This is an unofficial MCP server for Intigriti. It is not affiliated with, endorsed by, or officially connected to Intigriti. Use at your own risk and in accordance with Intigriti's terms of service and responsible disclosure policies.

💬 Support

🎯 Roadmap

Future enhancements may include:

  • File upload support for attachments

  • Webhook integration

  • Advanced filtering and search

  • Batch operations

  • Caching for improved performance

  • Unit tests and integration tests

  • TypeScript support


Made with ❤️ for the security research community

Available Tools

8 tools
intigriti_add_submission_commentA

Add a comment or update to an existing submission. Use this to respond to questions from the program team or provide additional information.

ParametersJSON Schema
NameRequiredDescriptionDefault
commentYesThe comment text to add
submission_idYesThe unique identifier of the submission

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of disclosing behavior. It only says 'add a comment or update,' but does not explain side effects, reversibility, required permissions, or what happens on success/failure. This is a significant gap for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loading the core action and then adding a practical use case. Every sentence provides useful information without redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (2 required params, no nested objects, no output schema) and the description covers the essential purpose and use case. However, the lack of annotations means some behavioral context is missing, so it is good but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both 'comment' and 'submission_id' clearly described. The tool description adds minimal extra meaning beyond saying 'comment or update,' which is already implied by the schema. Since the schema handles parameter semantics, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Add' and the resource 'comment or update to an existing submission,' which distinguishes it from sibling tools like intigriti_create_submission. It also specifies the intended purpose (responding to questions or providing info), making the tool's function unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly indicates when to use the tool: to respond to questions from the program team or provide additional information on a submission. It does not explicitly mention alternatives or exclusion cases, but the context is clear enough and no misleading guidance is present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intigriti_create_submissionA

Submit a new bug report to a program. Include title, description, severity, proof of concept, and affected endpoint.

ParametersJSON Schema
NameRequiredDescriptionDefault
titleYesBrief title of the vulnerability
endpointYesThe affected endpoint/URL from the program scope
severityYesSeverity level of the vulnerability
program_idYesThe unique identifier of the program to submit to
descriptionYesDetailed description of the vulnerability
proof_of_conceptYesSteps to reproduce and proof of concept
vulnerability_typeNoType of vulnerability (e.g., 'XSS', 'SQL Injection', 'CSRF')

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only states the action ('Submit') without mentioning side effects, permission requirements, reversibility, or what happens after submission. For a mutation tool, this is a significant gap. There is no indication that the submission will be visible to the program, that it cannot be undone, or that it requires authentication.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence: 'Submit a new bug report to a program. Include title, description, severity, proof of concept, and affected endpoint.' It is front-loaded with the main purpose and lists key parameters efficiently. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for a simple create tool, but it lacks context about the response or post-submission behavior. With no output schema and no annotations, the agent must rely on the description for what to expect. It does not mention that the submission will be created with an identifier, or that the program must be in scope. Given the tool has 7 parameters and no output schema, the description is minimally sufficient but leaves gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 100% description coverage, so the baseline is 3. The description adds minimal value by listing the key fields to include ('title, description, severity, proof of concept, and affected endpoint'), which aligns with the required parameters. However, it omits mention of 'program_id' and 'vulnerability_type', and does not add any semantic nuance beyond what the schema descriptions already provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Submit a new bug report to a program.' It uses a specific verb ('submit'), specifies the resource ('bug report'), and targets a program. This distinguishes it from sibling tools like intigriti_list_submissions (which lists) and intigriti_get_submission (which retrieves).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the usage context: when you have a new bug report to submit. It does not explicitly contrast with siblings or mention when not to use it (e.g., for editing or commenting). However, the tool name and sibling names ('list', 'get', 'comment') provide sufficient context. The description is clear enough that an agent would know this is the creation tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intigriti_get_programA

Get detailed information about a specific bug bounty program including scope, rewards, policy, response targets, and submission statistics.

ParametersJSON Schema
NameRequiredDescriptionDefault
program_idYesThe unique identifier of the program (format: company_handle/program_handle or UUID)

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full transparency burden. It does disclose the expected return content (scope, rewards, policy, response targets, submission statistics), which gives some indication of the tool's behavior. However, it does not explicitly state that this is a read-only operation, what permissions are required, or whether any side effects occur. The 'get' verb implies read-only, but the description could be more explicit about the operational context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the primary action and resource. Every phrase adds value by enumerating the expected output categories. There is no redundancy, filler, or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (one parameter, no output schema, no annotations), the description is reasonably complete. It lists the types of information returned, which is a key behavioral detail. However, it could be improved by explicitly stating the return format (e.g., 'returns an object') or noting any error conditions (e.g., invalid program_id). Since the tool is straightforward, this is a minor gap rather than a critical omission.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides a complete description of the sole parameter 'program_id', including its format and meaning. The tool description adds no additional parameter semantics beyond what is already in the schema. With schema description coverage at 100%, the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and resource ('detailed information about a specific bug bounty program'), clearly differentiating it from sibling tools like intigriti_list_programs (which lists programs) and intigriti_get_program_scope (which fetches scope only). The additional detail of what information is included (scope, rewards, policy, response targets, submission statistics) makes the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives. It does not mention when 'list_programs' would be more appropriate, nor does it note that 'get_program_scope' is a more specific option for scope-only needs. No exclusions, prerequisites, or alternative tool references are given, leaving the agent to infer usage solely from the tool name and sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intigriti_get_program_scopeA

Get the in-scope and out-of-scope assets (targets) for a specific program. Returns detailed scope information including endpoints, domains, and applications.

ParametersJSON Schema
NameRequiredDescriptionDefault
program_idYesThe unique identifier of the program

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. The word 'Get' implies a read-only operation, and the description mentions what is returned, but it does not disclose authentication requirements, potential errors, or any side effects. It adds some value by specifying scope content, but lacks deeper behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, directly states the tool's purpose and output, and contains no redundant or fluff content. Every word earns its place, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one required parameter and no output schema. The description covers the tool's purpose, identifies the parameter, and gives examples of returns. It is adequate but could mention if any authentication or specific conditions are needed, though this is a minor gap given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already explains program_id as 'The unique identifier of the program' with 100% coverage. The description reinforces the role of program_id by stating 'for a specific program', but does not add additional semantic meaning beyond the schema, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves scope assets (in-scope and out-of-scope) for a specific program, with concrete examples of returned data (endpoints, domains, applications). This distinguishes it from sibling tools like list_programs or get_program, which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives, nor does it mention prerequisites or exclusions. It only describes the action without contextual guidance, leaving the agent to infer that this is for scope-related queries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intigriti_get_researcher_statsA

Get your researcher statistics including total submissions, acceptance rate, reputation score, and earnings.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does not disclose authentication requirements, response format, or any potential side effects. It only lists data contents, which adds no behavioral context beyond the stated purpose—especially serious for a tool that might require user-specific data access.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that starts with the action ('Get your researcher statistics') and lists concrete data points. Every word contributes, with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (zero params, no output schema), and the description covers the main output fields. However, it omits details about authentication, whether 'your' implies the authenticated user, and whether the list is exhaustive or indicative ('including'). These gaps leave some ambiguity, though it is mostly sufficient for a basic stats getter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is empty (0 parameters), so schema coverage is 100% vacuously. The description adds value by enumerating the returned statistics, but since there are no parameters, it doesn't need to describe parameter semantics. Baseline for 0 params is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the function: retrieving the researcher's own statistics, explicitly listing key metrics (submissions, acceptance rate, reputation, earnings). This is distinct from sibling tools that handle programs or submissions, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus alternatives. It does not mention that this is for the authenticated user's personal stats, nor does it contrast with program/submission tools, leaving the agent without explicit context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intigriti_get_submissionA

Get detailed information about a specific bug submission including description, severity, status, and all communication.

ParametersJSON Schema
NameRequiredDescriptionDefault
submission_idYesThe unique identifier of the submission (UUID)

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. 'Get' implies a read-only operation, and it states what information is returned. However, it does not explicitly state that it is non-mutating, mention authentication requirements, or describe error behavior for invalid IDs, though these are arguably implied by the verb.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that directly states the tool's purpose and includes relevant return fields. Every word earns its place, with no redundancy or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema), the description adequately covers the returned data (description, severity, status, communication). It could be slightly more comprehensive by mentioning error cases or ownership constraints, but for a straightforward read tool it is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage for the single parameter `submission_id` with a clear description ('The unique identifier of the submission (UUID)'). The tool description adds no additional parameter semantics beyond what the schema already states, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and resource ('detailed information about a specific bug submission'), clearly distinguishing it from sibling tools like intigriti_list_submissions. It also lists key return fields (description, severity, status, communication), making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for retrieving details about one specific submission, as opposed to listing submissions. However, it does not explicitly name alternatives (e.g., 'use intigriti_list_submissions to find submission IDs') or provide when-not-to-use guidance, leaving usage context implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intigriti_list_programsA

List all available bug bounty programs on Intigriti that you have access to as a researcher. Returns program details including name, company, status, and rewards.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions access restrictions and the return fields, but does not explicitly confirm that the operation is read-only, nor does it discuss pagination, rate limits, or side effects. For a simple listing operation, this is somewhat adequate but incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the primary action, and free of redundancy. Every word contributes to understanding the tool's purpose and output, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema, no annotations), the description clearly explains what the tool does and what it returns. It does not mention pagination or authentication prerequisites, but for a listing operation with no other structured information, this is fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description is not expected to explain any. The schema coverage is trivially 100% with no params, and the description adds no parameter-related details because none exist. The baseline for 0 params is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (List), the resource (bug bounty programs on Intigriti), and the scope (that you have access to as a researcher). It also mentions the return details, making it distinct from sibling tools like intigriti_get_program which targets a single program.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool: to list all accessible bug bounty programs. It does not explicitly mention alternatives or exclusions, but the name and 'all available' phrasing imply it is the correct tool for an overview, as opposed to obtaining a single program's details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

intigriti_list_submissionsB

List your bug submissions across all programs or for a specific program. Filter by status, severity, or date range.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoOptional: Maximum number of results to return (default: 50)
statusNoOptional: Filter by submission status (e.g., 'open', 'closed', 'accepted', 'duplicate')
program_idNoOptional: Filter by specific program ID

TDQS

B3.2/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description claims filters for 'severity' and 'date range' that are not present in the input schema, which only includes status, limit, and program_id. This misleads the agent into believing unsupported functionality exists. Additionally, there are no annotations, and the description does not disclose pagination, limit behavior, or return format, but the false filter claims are the critical issue.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with two short sentences. It front-loads the core purpose and then lists filters. However, the second sentence contains inaccuracies, which reduces effectiveness, though the length is appropriate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, so the description should explain return values and behavioral details. It mentions listing and filtering but omits pagination/default limits, and the unsupported filter claims make the description incomplete and partially misleading for a tool with three optional parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 100% description coverage, so the baseline is 3. The description adds useful context that omitting program_id returns all programs, but the false mention of severity and date range filters detracts from the semantic clarity and misleads the agent about available parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists bug submissions, with the ability to scope to all programs or a specific one. The verb 'List' and resource 'submissions' are specific and distinguish it from siblings like intigriti_get_submission (singular retrieval) and intigriti_list_programs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context on when to use it: listing submissions across all programs or a specific one, and supports filtering. It does not explicitly name alternatives or exclusions, but the purpose is clear enough that an agent would know this is the list tool rather than get_submission.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 8 tool updatesv1.0.0
    • First observedintigriti_add_submission_comment
    • First observedintigriti_create_submission
    • First observedintigriti_get_program
    • First observedintigriti_get_program_scope
    • First observedintigriti_get_researcher_stats
    • First observedintigriti_get_submission
    • First observedintigriti_list_programs
    • First observedintigriti_list_submissions

TDQS

A4/5.0

Scored across 8 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: listing vs getting programs, program vs scope, listing vs getting submissions, creating vs commenting, and stats. No overlapping functionality.

Naming Consistency5/5

All tools follow the consistent pattern 'intigriti_verb_noun' (list_programs, get_program, get_program_scope, list_submissions, get_submission, create_submission, add_submission_comment, get_researcher_stats).

Tool Count5/5

8 tools is well-scoped for a bug bounty server, covering both program discovery and submission management without unnecessary bloat or missing essentials.

Completeness5/5

The surface covers the full researcher workflow: browse programs, inspect program details and scope, list and view submissions, create submissions, and communicate via comments. No obvious gaps for the domain.

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    D
    maintenance
    Provides a Model Context Protocol server implementation that allows AI agents and other MCP clients to programmatically interact with DefectDojo, a vulnerability management tool, for managing findings, products, and engagements.
    11
    16
    MIT
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables security researchers to interact with Intigriti's bug bounty platform through Claude Desktop, providing access to programs, scope, activities, and rules of engagement via natural language.
    1
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    Wraps multiple bug bounty platform APIs (HackerOne, Bugcrowd, etc.) behind a uniform MCP tool surface, enabling LLM agents to query programs, scope, and briefs across platforms through a single interface.
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol (MCP) server for the IssueHunt bug bounty platform. Enables LLMs like Claude to interact with IssueHunt to list organizations, programs, and vulnerability reports, as well as perform triage actions.
    -